The Security Breach at Nelm - Case Study Example

There should only be a limited number of people in the marketing department that have access to the advertising files. This would eliminate unauthorized access to this sensitive information by a member of the production or engineering staff.If the attack is coming from an outside source, system access needs to be secured and limited. This may be done by the addition of an effective user ID and password system. The system should require regular changing of the passwords and have a mechanism to lock out the user after a limited number of failed attempts to stop a brute force attack.

In addition, IP address monitoring should be implemented and users should be restricted from entering the system only from approved IPs. This would prevent off-site hackers from gaining access to the system. To further secure the system, the Web server needs to be properly configured. The web-based e-mail system will give unauthorized users a portal that may be exploited if the server has security flaws in it. An adequate firewall should be implemented that blocks most illegal activity. Weblogs should be constantly monitored for unauthorized activity.

In addition, sensitive server configuration files should only be accessible by the head of security. The system needs to be constantly updated to include the latest security patches, inactive users deleted and evaluated for an ongoing threat assessment.In most cases, data is stolen by the easiest method possible. When large numbers of employees have access to the entire system, it opens the possibility of insider theft of data. Internally, the system needs to be secured from users who are not authorized to view or alter certain files.

Authorized users need to change their passwords regularly to prevent unauthorized acquisition by a third party. To prevent access from outside hackers, the webserver needs to be configured and updated to an appropriate level of security. Limited access by IP address or through a firewall would help prevent unauthorized access. Monitoring weblogs to see who is accessing the files and when would point out irregularities. In data security, there is no one answer, but rather a series of actions that need to be taken at several levels in the information system.